Trade a refresh token for a new session
curl --request POST \
--url https://my.server.express/api/v1/auth/refresh \
--header 'Content-Type: application/json' \
--data '
{
"refreshToken": "<string>"
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({refreshToken: '<string>'})
};
fetch('https://my.server.express/api/v1/auth/refresh', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/auth/refresh"
payload = { "refreshToken": "<string>" }
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"accessToken": "<string>",
"refreshToken": "<string>",
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"email": "[email protected]",
"firstName": "<string>",
"lastName": "<string>",
"role": "CLIENT"
}
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}Auth
Trade a refresh token for a new session
Rotates the refresh token: the one you send is dead the moment this returns, and you get a fresh access token (15-minute JWT) and refresh token (30 days, sliding). Replaying a spent token more than 15 seconds after it was rotated revokes every session on the account. Every failure is the same flat 401 — send the user back to sign in. A banned account gets 403 with code: ACCOUNT_BANNED. Rate-limited to 120 requests per 15 minutes per IP.
POST
/
v1
/
auth
/
refresh
Trade a refresh token for a new session
curl --request POST \
--url https://my.server.express/api/v1/auth/refresh \
--header 'Content-Type: application/json' \
--data '
{
"refreshToken": "<string>"
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({refreshToken: '<string>'})
};
fetch('https://my.server.express/api/v1/auth/refresh', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/auth/refresh"
payload = { "refreshToken": "<string>" }
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"accessToken": "<string>",
"refreshToken": "<string>",
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"email": "[email protected]",
"firstName": "<string>",
"lastName": "<string>",
"role": "CLIENT"
}
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}